CVE-2025-24903

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user. The origin of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-249048.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with SigCVE-2025-249059.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarrasCVE-2025-249069.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobCVE-2025-249076.8Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not propCVE-2025-249086.8Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not propCVE-2025-249094.4Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is uCVE-2025-24915.4A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/comCVE-2025-249104.9Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249114.9Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249123.7hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker iCVE-2025-249147.8When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sCVE-2025-249157.8When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permi